Privacy Policy

Sharkling is operated by Heap Labs LLC (“Heap Labs”, “we”, “us”), the data controller for sharkling.io, a poker training app. This policy explains what personal data we collect, why, and the choices you have. It applies to the website and web app; it does not cover third-party sites we link to.

Questions or requests: email support@heaplabs.co.

• Account data. Your email address, display name, and (if you sign in with Google) your Google account id and avatar. We never see your Google password.
• Learning activity. Lessons completed, drill and puzzle answers, XP, streaks, hearts, and accuracy stats — the data that powers your progress, leak dashboard, and personalized practice.
• Billing data. If you subscribe, payments are processed by Stripe. We store your subscription tier, status, and Stripe customer reference — never your card number.
• Technical data. Server logs (IP address, request path, timing) kept for security and debugging, and — where permitted or consented — analytics events (pages visited, features used) via Google Analytics 4.

• We don't sell or rent your personal data, and we never have.
• We don't handle real-money gambling, wagers, or payouts of any kind — Sharkling is a training tool.
• We don't show third-party ads or share your data with ad networks.

We use Google Analytics 4 with Google Consent Mode to understand which lessons land and where players get stuck. In the EEA, the UK, and Switzerland — where the law requires opt-in consent — no analytics cookies or identifiers are set unless you accept the consent banner; until then (and if you decline) Google receives only aggregate, cookieless, identifier-free signals. Elsewhere, analytics runs by default; declining via the banner or contacting us switches it to the same cookieless mode, and we’ll remember the choice on this device. Declining never changes how the app works.

Your consent choice is stored in your browser’s local storage (key sharkling-consent). To change it, clear that value from your browser storage and revisit the site, or email us and we’ll walk you through it.

• Session cookie (essential) — keeps you signed in. Set by our auth system; no consent required because the app can’t work without it.
• Consent choice (essential, local storage) — remembers your analytics decision.
• Analytics cookies (optional, _ga*) — set only when analytics is active, per the consent rules above.

We use a small set of infrastructure providers, each under a data processing agreement, and share only what each needs:

• Amazon Web Services (USA, us-east-1) — hosting, database, and log storage.
• Stripe (USA) — payment processing and subscription billing.
• Resend (USA) — transactional email (sign-in links, receipts, streak reminders).
• Google (USA) — optional Google sign-in, and Google Analytics 4 as described above.

Our servers are in the United States. If you use Sharkling from the EEA/UK, your data is transferred to the US under standard contractual clauses and, where applicable, the EU–US Data Privacy Framework certifications of the providers above.

Account and learning data is kept while your account is active and deleted within 30 days of an account deletion request. Billing records are retained as long as tax and accounting law requires. Server logs rotate automatically and are kept for no more than 90 days.

Depending on where you live (GDPR in the EEA/UK, CCPA/CPRA in California, and similar laws elsewhere), you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing based on legitimate interests. Email support@heaplabs.co and we’ll respond within 30 days. EEA/UK residents can also lodge a complaint with their local supervisory authority.

Sharkling teaches poker and is intended for adults. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we’ll delete it.

If we make material changes to this policy we’ll notify you by email or an in-app notice before they take effect. The “last updated” date above always reflects the current version. See also our Terms of Service.